Yep, login with POST to http://www.taste.io/auth/local and creating an account (POST http://www.taste.io/api/users) are made without ssl. name, password and emails are sent in clear over the network.